CVE-2026-43314: dm: remove fake timeout to avoid leak request
In the Linux kernel, the following vulnerability has been resolved:
dm: remove fake timeout to avoid leak request
Since commit 15f73f5b3e59 ("blk-mq: move failure injection out of blkmqcompleterequest"), drivers are responsible for calling blkshouldfaketimeout() at appropriate code paths and opportunities.
However, the dm driver does not implement its own timeout handler and relies on the timeout handling of its slave devices.
If an io-timeout-fail error is injected to a dm device, the request will be leaked and never completed, causing tasks to hang indefinitely.
Reproduce: 1. prepare dm which has iscsi slave device 2. inject io-timeout-fail to dm echo 1 >/sys/class/block/dm-0/io-timeout-fail echo 100 >/sys/kernel/debug/failiotimeout/probability echo 10 >/sys/kernel/debug/failiotimeout/times 3. read/write dm 4. iscsiadm -m node -u
Result: hang task like below [ 862.243768] INFO: task kworker/u514:2:151 blocked for more than 122 seconds. [ 862.244133] Tainted: G E 6.19.0-rc1+ #51 [ 862.244337] "echo 0 > /proc/sys/kernel/hungtasktimeoutsecs" disables this message. [ 862.244718] task:kworker/u514:2 state:D stack:0 pid:151 tgid:151 ppid:2 taskflags:0x4288060 flags:0x00080000 [ 862.245024] Workqueue: iscsictrl3:1 iscsiunbindsession [scsitransportiscsi] [ 862.245264] Call Trace: [ 862.245587] <TASK> [ 862.245814] schedule+0x810/0x15c0 [ 862.246557] schedule+0x69/0x180 [ 862.246760] blkmqfreezequeuewait+0xde/0x120 [ 862.247688] elevatorchange+0x16d/0x460 [ 862.247893] elevatorsetnone+0x87/0xf0 [ 862.248798] blkunregisterqueue+0x12e/0x2a0 [ 862.248995] delgendisk+0x231/0x7e0 [ 862.250143] delgendisk+0x12f/0x1d0 [ 862.250339] sdremove+0x85/0x130 [sdmod] [ 862.250650] devicereleasedriverinternal+0x36d/0x530 [ 862.250849] busremovedevice+0x1dd/0x3f0 [ 862.251042] devicedel+0x38a/0x930 [ 862.252095] scsiremovedevice+0x293/0x360 [ 862.252291] scsiremovetarget+0x486/0x760 [ 862.252654] iscsiunbindsession+0x18a/0x3e0 [scsitransportiscsi] [ 862.252886] processonework+0x633/0xe50 [ 862.253101] workerthread+0x6df/0xf10 [ 862.253647] kthread+0x36d/0x720 [ 862.254533] retfromfork+0x2a6/0x470 [ 862.255852] retfromforkasm+0x1a/0x30 [ 862.256037] </TASK>
Remove the blkshouldfaketimeout() check from dm, as dm has no native timeout handling and should not attempt to fake timeouts.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2026-43314?
CVE-2026-43314 has been classified with a medium severity level due to its potential impact on request leakage.
How do I fix CVE-2026-43314?
To fix CVE-2026-43314, you should update the Linux kernel (device-mapper) to a patched version that eliminates the fake timeout issue.
What types of systems are affected by CVE-2026-43314?
CVE-2026-43314 affects systems running the Linux kernel, specifically those utilizing the device-mapper.
Is CVE-2026-43314 remotely exploitable?
CVE-2026-43314 is not considered remotely exploitable as it requires local access to the affected system.
What potential impacts does CVE-2026-43314 pose?
CVE-2026-43314 could lead to unauthorized information disclosure due to request leakage if left unaddressed.